CMS Security
WordPress Theme Editor Access Check
The WordPress theme editor allows direct code modification. Check that it is disabled to prevent an attacker from injecting malicious code in case of compromise.
What this test checks
This test checks whether the WordPress theme editor (theme-editor.php) is accessible. This tool allows direct modification of your theme's PHP, CSS, and JavaScript files from the admin interface. If an attacker gains authenticated access, they can insert malicious code or alter your site's functionality, leading to critical risks.
Our recommendation
Disable the theme editor by adding the following line to your wp-config.php: define('DISALLOW_FILE_EDIT', true);. This directive also disables the plugin editor. Use a local or staging development environment to modify code, then deploy changes via FTP or Git rather than doing them in production.
Security tests
Read more
Server Configuration